dependabot-python 0.196.4 → 0.197.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1bc79e828f60a77c98c0db059795430716f086cbaa9f675511568e0cd27e6a4c
-  data.tar.gz: cc4a2fd2e89587e63dc65e1f621f933cda71ca89cbe71d52d2c88886fb00dc3d
+  metadata.gz: 942b633bb536e1db742099aa6198a1c571779afd43178cc89de793de61c368f1
+  data.tar.gz: f76a1116d377f0f664bbac363669e135057a13ab3e17c9754647ce7914ecf981
 SHA512:
-  metadata.gz: 8941fea7946bf352c2437d5a1b8f43223640741f2aec8c4013ccb2102312930a2d6eeedff52709133540a129705ffdf7a3473a38c07dc0ec16493b7f8cebc78d
-  data.tar.gz: a6f22b171b9809cc088d5062f5da3f1a2640db1dffe1fc04643f6580cfae2386208962c76705a6e3603a9d851fd3224edf58cb965d71ef6c36c7f1621868a093
+  metadata.gz: 6fdac7a0ef17c8888b28f041c29bf7caf6036e3065ff37a5b9ffbc255d16e5b59ea84919200317116696dad382477c177abc9f4e010997b02945a48070699154
+  data.tar.gz: a1efbee21bd62eef7fbc4c426f9e782df083f032df9c8a6c125a176e82e63046bc9891283fb205f96345d84e876f2ce6ca39e1eb73d3d7af6efc86d8feab0607

data/lib/dependabot/python/update_checker/pip_compile_version_resolver.rb

@@ -32,6 +32,8 @@ module Dependabot
           "pip._internal.exceptions.InstallationSubprocessError: Command errored out with exit status 1:"
         # See https://packaging.python.org/en/latest/tutorials/packaging-projects/#configuring-metadata
         PYTHON_PACKAGE_NAME_REGEX = /[A-Za-z0-9_\-]+/.freeze
+        RESOLUTION_IMPOSSIBLE_ERROR = "ResolutionImpossible"
+        ERROR_REGEX = /(?<=ERROR\:\W).*$/.freeze
 
         attr_reader :dependency, :dependency_files, :credentials
 
@@ -76,16 +78,13 @@ module Dependabot
                   # Shell out to pip-compile.
                   # This is slow, as pip-compile needs to do installs.
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe -v "\
-                     "#{pip_compile_options(filename)} -P #{dependency.name} "\
-                     "#{filename}"
+                    "pyenv exec pip-compile -v #{pip_compile_options(filename)} -P #{dependency.name} #{filename}"
                   )
                   # Run pip-compile a second time, without an update argument,
                   # to ensure it handles markers correctly
                   write_original_manifest_files unless dependency.top_level?
                   run_pip_compile_command(
-                    "pyenv exec pip-compile --allow-unsafe "\
-                     "#{pip_compile_options(filename)} #{filename}"
+                    "pyenv exec pip-compile #{pip_compile_options(filename)} #{filename}"
                   )
                 end
 
@@ -114,7 +113,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         # rubocop:disable Metrics/PerceivedComplexity
         def handle_pip_compile_errors(error)
-          if error.message.include?("Could not find a version")
+          if error.message.include?(RESOLUTION_IMPOSSIBLE_ERROR)
             check_original_requirements_resolvable
             # If the original requirements are resolvable but we get an
             # incompatibility error after unlocking then it's likely to be
@@ -138,7 +137,7 @@ module Dependabot
             return
           end
 
-          if error.message.include?("Could not find a version ") &&
+          if error.message.include?(RESOLUTION_IMPOSSIBLE_ERROR) &&
              !error.message.match?(/#{Regexp.quote(dependency.name)}/i)
             # Sometimes pip-tools gets confused and can't work around
             # sub-dependency incompatibilities. Ignore those cases.
@@ -179,7 +178,7 @@ module Dependabot
 
               filenames_to_compile.each do |filename|
                 run_pip_compile_command(
-                  "pyenv exec pip-compile #{pip_compile_options(filename)} --allow-unsafe #{filename}"
+                  "pyenv exec pip-compile #{pip_compile_options(filename)} #{filename}"
                 )
               end
 
@@ -188,7 +187,7 @@ module Dependabot
               # Pick the error message that includes resolvability errors, this might be the cause from
               # handle_pip_compile_errors (it's unclear if we should always pick the cause here)
               error_message = [e.message, e.cause&.message].compact.find do |msg|
-                ["UnsupportedConstraint", "Could not find a version"].any? { |err| msg.include?(err) }
+                msg.include?(RESOLUTION_IMPOSSIBLE_ERROR)
               end
 
               cleaned_message = clean_error_message(error_message || "")
@@ -220,6 +219,7 @@ module Dependabot
         def pip_compile_options(filename)
           options = @build_isolation ? ["--build-isolation"] : ["--no-build-isolation"]
           options += pip_compile_index_options
+          options += ["--resolver backtracking", "--allow-unsafe"]
 
           if (requirements_file = compiled_file_for_filename(filename))
             options << "--output-file=#{requirements_file.name}"
@@ -353,25 +353,8 @@ module Dependabot
           NameNormaliser.normalise(name)
         end
 
-        VERBOSE_ERROR_OUTPUT_LINES = [
-          "Traceback",
-          "Using indexes:",
-          "Current constraints:",
-          "Finding the best candidates:",
-          "Finding secondary dependencies:",
-          "\n",
-          "  "
-        ].freeze
-
         def clean_error_message(message)
-          msg_lines = message.lines
-          msg = msg_lines.
-                take_while { |l| !l.start_with?("During handling of") }.
-                drop_while { |l| l.start_with?(*VERBOSE_ERROR_OUTPUT_LINES) }.
-                join.strip
-
-          # Redact any URLs, as they may include credentials
-          msg.gsub(/http.*?(?=\s)/, "<redacted>")
+          message.scan(ERROR_REGEX).last
         end
 
         def filenames_to_compile

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.196.4
+  version: 0.197.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-14 00:00:00.000000000 Z
+date: 2022-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.4
+        version: 0.197.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.196.4
+        version: 0.197.0
 - !ruby/object:Gem::Dependency
   name: debase
   requirement: !ruby/object:Gem::Requirement